Privacy Notice

1. Who is responsible for your data

Ludren Technologies Limited is the controller of the personal data described here. Its company details and how to reach it are on Contact.

2. What we hold

Account and sign-in data: your email address, the sign-in links sent to it and when they were used, a display handle, and whether you are an administrator. There is no password.

Purchase records: each order (plot, kind, amounts in cash and Club Credits, status, dates), the version and hash of the terms you accepted and when, the Stripe Checkout Session and payment identifiers, the email address the payment was made from as Stripe reports it, refunds and disputes, and payment exceptions. We never receive or store card numbers.

Plot and brand records: which plots you hold or have held and for which terms, takeover protection dates, credit value, Club Credit tranches and their expiry, development bought, and the brand name, description, category, website link and logo you upload. A brand placed on a plot is shown publicly on the map, the plot page, the directory, search and share cards.

Click and usage records: a count of page visits to your plot and of clicks through to your website, shown only to you; content reports and appeals and their outcomes; moderation actions; and signals the system records to detect abuse of takeovers (for example repeated self-dealing between accounts), which are shown only to administrators.

Messages: the operational emails we send you (receipts, takeover and expiry notices, credit notices, moderation notices) and their delivery status.

3. Why, and on what basis

To provide the service you asked for and perform our contract with you: signing you in, taking payment, running your plot term, applying and expiring Club Credits, showing your brand, and sending the receipts and notices the service requires (performance of a contract).

To keep accurate accounting, tax and dispute records, and to answer a complaint or a payment dispute (legal obligation, and our legitimate interest in defending claims).

To keep the service safe: preventing fraud and abuse, moderating reported content, and protecting other members (our legitimate interests, balanced against yours).

We do not use your data for marketing. Promotional email would require your separate opt-in, and nothing here sends it.

4. Who processes it for us

Supabase (database, authentication and file storage; our project is hosted in the London region), Stripe (card payments, refunds and disputes; Stripe is an independent controller of the payment data it collects, under its own privacy notice), Vercel (hosting and running the website, including request logs) and Resend (sending our operational email). Each processes data only on our instructions under a written contract, except Stripe where it acts as a controller.

Some of these providers, or their sub-processors, operate outside the United Kingdom, including in the United States. Where that happens the transfer is covered by the UK International Data Transfer Agreement or Addendum, or by a UK adequacy decision. We do not sell personal data to anyone.

5. How long we keep it

Purchase, acknowledgement, payment, refund and dispute records are kept for six years after the transaction, because they are our accounting and tax records and the evidence of what was agreed. Account data is kept while your account exists and for six years after the last purchase. Brand content comes off the map when a term ends but stays in your account until you delete it or close your account. Operational email records are kept for as long as the order they concern. Request and security logs held by our hosting provider are kept for a short rolling period.

If Claim The Club closes, the same retention applies to the records that must be kept; everything else is deleted.

6. Cookies and similar technologies

Claim The Club uses only strictly necessary cookies: the authentication cookies that keep you signed in, and -- while the site is a private review -- the review-access cookie that remembers the review password was entered. Neither is used for tracking, and neither needs a consent banner. The development builder keeps your in-progress selection for a plot in your browser's session storage so you can return to a purchase; that stays in your browser and never reaches us.

No analytics or advertising cookies, pixels or trackers are set. We do not currently use any analytics service. If that changes, this notice will say so and any non-essential technology will be off until you agree to it.

7. How we protect it

All traffic is encrypted in transit. Card details go directly to Stripe and never touch our servers. Database access from the website runs on our servers with row-level security enforced in the database itself; money and ownership change only through audited database functions, never from the browser. Administrator access is limited to one named account, every administrator action is recorded with its reason, and personal data shown to administrators is masked except where the task needs it.

8. Your rights

You can ask us for a copy of your personal data, to correct it, to delete it (subject to the records we must keep), to restrict or object to processing based on our legitimate interests, and to receive the data you gave us in a portable form. Write to us through Contact; we will reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk, though we would rather hear from you first.

9. Changes to this notice

This notice is dated. If we change what we collect or why, we will update it here and, for a material change, tell account holders by email.